Why Encryption Alone May Not Protect Data in Use

Summary

A policy op-ed argues that vaultless, keyless pseudonymization could limit exposure of sensitive data across systems and urges federal agencies to evaluate the approach and related procurement claims.

Key points

• The author argues encryption does not protect data while it is being processed and that data can be exposed as it moves between systems.
• Vaultless, keyless pseudonymization replaces sensitive values with realistic substitutes while preserving their format for processing.
• A model assessed by the Foundation for Defense of Democracies’ Transformative Cyber Innovation Lab reportedly allowed restoration only with required multi-party authorization.
• The assessment reportedly found unauthorized restoration attempts failed and were logged, while intercepted tokens did not reveal original values.
• The author says the approach could reduce the impact of breaches or ransomware if exposed data has less intrinsic value.
• The piece urges NIST and the NSA to evaluate the technology and recommends clearer procurement scrutiny of vendor data-protection claims.

Industries